Extracted

Extracted

Extracted

• • Target
    0da4509df08282f3acf044025284acf5.exe
  • Size 263KB
  • SHA256 2b1b66d7ab2022d41004937b8ea3d9f375364347b4f51d9d14bddc314296a1c5
  • MD5 0da4509df08282f3acf044025284acf5
  • SHA1 caac8c2ec54f8113e8875024ea93156c77b94a00
  • SHA512 26c379bb180600428fad199eba587241c3e126ef1eabdf208f5510db0602848698fa0e5938f6c75c57936189341e0788575536dc06ede90e65801da0b0fcebdf
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoonsmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4�ru2ac�^�����wl,q֎�b��mc1/`�`�1k�:�y�backdoordiscoveryspywarestealertrojan

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2